CVE-2026-84188
Received Received - Intake

Stored XSS in LibreNMS Graph Configuration Settings

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description
LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in version 26.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84188
EUVD
EUVD-2026-69025

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
librenms librenms to 26.4.0 (inc)
librenms librenms to 26.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in LibreNMS versions before 26.7.0. It occurs because user input in graph_descr.<graphtype> settings is echoed without HTML escaping in includes/html/pages/graphs.inc.php. An admin can inject malicious HTML or JavaScript that executes in browsers of authenticated users viewing the affected graph type.

Detection Guidance

Check LibreNMS version with: grep '"version"' /opt/librenms/version.php. If version <= 26.4.0, the system is vulnerable. Inspect includes/html/pages/graphs.inc.php for unsanitized graph_descr.<graphtype> output.

Impact Analysis

An attacker with admin access can inject malicious scripts that execute in browsers of other authenticated users. This could lead to session hijacking, data theft, or unauthorized actions on behalf of users. The impact is limited to authenticated users viewing specific graph types.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to the stored XSS allowing unauthorized script execution in user browsers. GDPR requires protection against unauthorized data access or modification, which this flaw could facilitate. HIPAA mandates safeguards against unauthorized access to protected health information, which could be compromised via malicious scripts.

Mitigation Strategies

Upgrade LibreNMS to version 26.7.0 or later. If immediate upgrade is not possible, manually escape graph_descr.<graphtype> output in includes/html/pages/graphs.inc.php using htmlspecialchars().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84188. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart